AdminNeo versions prior to 5.5.1 contain a vulnerability in their SQLite interface that allows authenticated users to execute arbitrary code. The application blocks ATTACH queries to prevent arbitrary file creation, but does not block the VACUUM INTO command, which can write the entire database to an arbitrary file path. An attacker can exploit this by injecting PHP code into a table name and then using VACUUM INTO to write a web shell to the web root, enabling remote command execution.